Who did what, where, when—and whether it worked.
Data Convoy keeps an append-only history of privileged mutations, denied attempts, worker lifecycle events, authentication, and selected sensitive reads.
Useful detail, not a request firehose
Events include a snapshotted actor label, team visibility scope, action, target, method, path, outcome, network context, and redacted action metadata. High-frequency polling and worker heartbeats are intentionally excluded.
Logs outlive the records they describe
Audit actor and team identifiers are not foreign-key cascaded. Deleting a user or team does not erase the record of the action that caused it.
Archive before delete
Retention maintenance writes old events as NDJSON to the customer’s own log bucket before removing the database rows. Verbose worker logs use the same customer-owned storage path and can be viewed from the job detail page.
Your buckets. Your workers. Your control.